Drupal Commerce Core bypass under active exploit by hackers

Hackers are actively exploiting a highly critical authorization bypass in Drupal Commerce Core (CVE-2026-118539), allowing unauthenticated attackers to abuse unprotected routes and entity fields in ways that may financially harm store owners. Drupal urges upgrades to Commerce Core 3.3.13 or 8.x-2.41 and order audits, as coverage from the hacker news and peers confirms.

Key Takeaways

• CVE-2026-118539 is a missing-authorization flaw in Drupal Commerce Core, rated highly critical with a Drupal risk score of 21 out of 25.
• Unauthenticated attackers can exploit the bug regardless of how the module is configured, creating financial risk for online vendors.
• Fixed releases are Commerce Core 3.3.13 (3.x branch) and Commerce Core 8.x-2.41 (earlier versions); store owners should also audit orders for inconsistencies.
• The community module powers shopping carts and checkout on more than 42,000 Drupal sites, including high-profile organizations.

Drupal warned that threat actors are exploiting the access bypass in the wild but has not detailed how attacks work, who is behind them, or how many sites have been hit. For merchants tracking payment and store risk, related coverage lives in our Fintech & Crypto Alerts hub.

What is CVE-2026-118539 and why does it matter?

Commerce Core is a contributed Drupal module that lets sites sell goods and services through a shopping cart and checkout form, or via APIs in decoupled apps. According to Drupal's advisory, the module does not sufficiently protect certain routes and entity fields, creating an access bypass that may financially impact the vendor.

SecurityWeek reported the issue scored 21 of 25 on Drupal's risk scale, and that unauthenticated attackers can exploit it no matter how the module is set up. BleepingComputer noted the module is used on more than 42,000 websites, including Fortune 500 companies and research universities.

Affected releases include Commerce Core versions from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13. The Hacker News cited Drupal's advisory describing the flaw as highly critical and actively exploited.

How should store owners respond right now?

Drupal recommends immediate upgrades: sites on the 3.x line should move to Commerce Core 3.3.13, while earlier versions should upgrade to Commerce Core 8.x-2.41. The advisory also states sites should audit their orders for inconsistencies because the vulnerability is being actively exploited.

Drupal has not said whether the bug was exploited as a zero-day before patches shipped. Researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd) were credited with reporting the flaw, per The Hacker News.

Full technical context is available in The Hacker News report on the Drupal Commerce Core exploit, alongside parallel reporting from SecurityWeek and BleepingComputer.

Are other recent Drupal flaws part of the same picture?

The Commerce Core warning arrived amid a busy patch cycle. SecurityWeek noted Drupal published dozens of other advisories on October 28 covering vulnerabilities in 21 contributed projects, with nearly a dozen rated critical—including issues that could lead to remote code execution, account takeover, or Commerce orders via Stripe being marked as paid without payment.

In May, attackers targeted a highly critical SQL injection issue in Drupal core's database abstraction API (CVE-2026-9082) affecting PostgreSQL-backed sites. BleepingComputer recalled that CISA later added that flaw to its Known Exploited Vulnerabilities catalog. Separately, October 14 fixes addressed two critical RCE bugs (CVE-2026-108097 and CVE-2026-108099); so far there have been no public reports of those being exploited in the wild.

For online stores, the immediate priority remains clear: patch Commerce Core, verify order integrity, and monitor checkout and payment flows for anomalies tied to this authorization bypass.